Apple RTKit CVE-2024-23296
HIGHCVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.4 and iPadOS 17.4, macOS Monterey 12.7.6, macOS Sonoma 14.4, macOS Ventura 13.6.7, tvOS 17.4, visionOS 1.1, watchOS 10.4. An attacker with arbitrary kernel read and write capability may be able to bypass kernel memory protections. Apple is aware of a report that this issue may have been exploited.
AnalysisAI
Kernel memory protection bypass in Apple's RTKit real-time operating system allows attackers with existing arbitrary kernel read/write primitives to defeat kernel hardening mitigations across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. The flaw is confirmed actively exploited (CISA KEV) and Apple has acknowledged in-the-wild abuse, making this a critical post-exploitation primitive used in chained attacks despite a modest EPSS score of 0.17%.
Technical ContextAI
RTKit is Apple's proprietary embedded real-time operating system used across coprocessors and security-critical components in Apple silicon devices. The root cause is classified as CWE-787 (Out-of-bounds Write), a memory corruption class where insufficient bounds validation allows writes outside intended buffer boundaries. The fix introduces improved input validation to prevent the corruption that enabled bypassing kernel memory protections such as KTRR (Kernel Text Read-Only Region) and PPL (Page Protection Layer). The CPE data confirms the issue spans the operating system kernels of all major Apple platforms - iOS, iPadOS, macOS (Monterey, Ventura, Sonoma branches), tvOS, visionOS, and watchOS - indicating a shared codebase component.
RemediationAI
Vendor-released patches are available: upgrade to iOS 16.7.8 or iPadOS 16.7.8, iOS 17.4 or iPadOS 17.4, macOS Monterey 12.7.6, macOS Ventura 13.6.7, macOS Sonoma 14.4, tvOS 17.4, visionOS 1.1, or watchOS 10.4 as appropriate for each device. Given confirmed active exploitation per CISA KEV, prioritize this update across managed device fleets and enforce via MDM. Federal agencies are obligated by CISA BOD 22-01 to remediate within the KEV-specified deadline. No workarounds are documented by Apple; for devices that cannot be immediately patched, consider enabling Lockdown Mode on supported iOS/macOS versions to reduce kernel attack surface - note this disables several features including some message attachments, web technologies, and configuration profiles.
More from same product – last 7 days
SQL injection in Pimcore's CustomReportsBundle (versions ≤ 12.3.5) lets an authenticated user holding the reports_config
Arbitrary code execution in Docker Model Runner's vllm-metal inference backend on macOS allows any container on the Dock
Arbitrary code execution in Docker Desktop's Model Runner on macOS allows any container on the Docker network to escape
Local privilege escalation in Apple macOS allows a malicious app already running with low privileges to elevate to root
Local privilege escalation in Canonical Multipass for macOS before 1.16.3 allows a low-privileged local user to obtain r
Share
External POC / Exploit Code
Leaving vuln.today